EO Engineering Learning OS
PROJECT LADDER · P02
Back to map ↑
CORE PROJECT · TARGET L3 · 4–5 days
P02

Authentication + Git

Add identity, protected operations and collaborative source control without embedding secrets.

01 / CONCEPT MAP

Know what the parts mean.

Learn each concept deeply enough to recognize it, place it in the system and reason about normal and failed behavior.

01

bcrypt

Define it · locate it · observe it · explain its failure mode.

02

JWT structure and expiry

Define it · locate it · observe it · explain its failure mode.

03

Protected APIs

Define it · locate it · observe it · explain its failure mode.

04

Environment secrets

Define it · locate it · observe it · explain its failure mode.

05

Git workflow

Define it · locate it · observe it · explain its failure mode.

02 / SYSTEM FLOW

Trace it end to end.

Credentials→Password verification→Token issuance→Bearer request→Authorization→protected result

For every transition: identify input, output, identity, protocol, state, trust boundary, evidence and owner.

03 / GUIDED BUILD

Build, observe and explain.

Documentation and AI are allowed. The engineer must review every output and demonstrate the result from direct evidence.

  1. 01Hash passwords
  2. 02Issue expiring JWTs
  3. 03Protect user routes
  4. 04Move secrets to environment
  5. 05Add ignore rules
  6. 06Review through a pull request
04 / INCIDENT

Tokens validate locally but fail after deployment because instances use different secrets.

Required investigation

State impact → collect evidence → form competing hypotheses → test the cheapest discriminator → isolate root cause → contain → correct → verify.

Evidence pack

Timeline, relevant logs/metrics, failed assumptions, root cause, correction, verification and one prevention action.

AI ownership

AI may suggest causes and commands. The engineer must explain why each check is safe, what result is expected and how the result changes the hypothesis.

05 / DESIGN CHALLENGE

Defend the decision.

Choose token lifetime, claims, secret storage and revocation approach for this learning app.

06 / VERIFY, SUBMIT & REVIEW

Submission evidence

Architecture review

  • Explain authentication + git without relying on memorized commands.
  • Draw the flow and name what crosses every arrow.
  • Identify the most likely, highest-impact and hardest-to-detect failure.
  • Show the evidence that proves the solution works.
  • Defend one security, reliability and cost trade-off.

Definition of Done

  • Acceptance criteria pass
  • Flow is drawn and explained
  • Security implications considered
  • Logs/metrics checked
  • Failure is tested
  • AI output is understood
  • Runbook is reusable
  • Mentor review passes
07 / MENTOR GUIDE

Do not score memory. Score the engineer’s ability to form a model, collect evidence, make a safe change and defend the trade-off.

1 Cannot explain2 Understands with gaps3 Implements and troubleshoots4 Designs and reviews